inmtoken[.]com

This domain, inmtoken.com, poses a high-risk brand impersonation threat specifically targeting users of the Across protocol. Analysis indicates the site mimics the official imToken wallet interface, presenting itself as "imToken 官网" to deceive victims into interacting with fraudulent smart contracts or disclosing wallet recovery phrases. The objective appears to be unauthorized asset transfer, commonly referred to as a crypto drainer attack, where funds are siphoned from compromised wallets to attacker-controlled addresses. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on March 11, 2026, through Gname.com Pte. Ltd., and resolves to IP address 45.65.45.34 hosted in Hong Kong under AS32708 (Root Networks). Security vendors on VirusTotal flagged the domain as malicious, with 22 out of 95 engines detecting it. Additionally, the domain appears on three security blocklists and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate issued by Let's Encrypt (R12) provides no inherent trust, as it is commonly abused in phishing campaigns. Users who visited inmtoken.com or interacted with its content should immediately revoke any smart contract approvals associated with the Across protocol or other DeFi applications. Wallet recovery phrases or private keys entered on this site must be considered compromised. Affected individuals should transfer remaining assets to a new, secure wallet and monitor transaction history for unauthorized activity. No further interaction with the domain or its associated infrastructure should occur, as it remains a verified threat vector for crypto asset theft.